CVE-2024-39317 Wagtail regular expression denial-of-service via search query parsing
Attackers can cause denial of service in Wagtail CMS by submitting crafted search queries that trigger excessive processing time in the query parser.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-39317?
CVE-2024-39317 is a medium-severity denial of service vulnerability in wagtail, published on 11 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, `parse_query_string` would take an unexpectedly large amount of time to process, resulting in a denial of service. In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses `parse_query_string`, it may be exploitable by other users (e.g. unauthenticated users). Patched versions have been released as Wagtail 5.2.6, 6.0.6 and 6.1.3.
Weakness: CWE-1333
Which versions are affected by CVE-2024-39317?
7 open source packages ship an affected version, including wagtail. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wagtail PyPI | From 2.0 | 5.2.6 |
wagtail PyPI | From 2.0 | 5.2.6 |
wagtail PyPI | From 6.0 | 6.0.6, 6.1.3, 5.2.6 |
wagtail PyPI | From 6.0 | 6.0.6 |
wagtail PyPI | From 6.0 | 6.0.6 |
wagtail PyPI | From 6.1 | 6.1.3 |
1 more packages
wagtail PyPI | From 6.1 | 6.1.3 |
Products include Torchbox Wagtail.
How do I fix CVE-2024-39317?
Upgrade wagtail to a fixed version for your release line: 5.2.6, 6.0.6 or 6.1.3.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-39317 being exploited?
There is no known exploitation of CVE-2024-39317 in the wild and no public exploit code.
Other vulnerabilities in wagtail
- CVE-2026-54263 Wagtail: Reflected XSS in dynamic image URL generator view
- CVE-2026-54261 Wagtail: Improper permission handling in image preview
- CVE-2026-44197 Wagtail: Improper permission handling when comparing revisions
- CVE-2026-44199 Wagtail: Improper permission handling when deleting form submissions
- CVE-2026-44200 Wagtail: Improper permission handling when copying pages
Sources
Also known as GHSA-jmp3-39vp-fwg8, PYSEC-2024-86, ROOT-APP-PYPI-CVE-2024-39317.